When setting up the CLI on a new system, I noticed that the default configuration file created by the exercism configure --token=asdf command at ~/.config/exercism/user.json has 644 permissions by default. That makes the file, and the API token within it, globally readable by any other user on the system.
User config files containing any form of authentication should always be stored with 600 permissions (and possibly refuse to be processed if permissions are more open, like with ssh)
I suspect the write just inherits permissions from the parent directory. But we do explicitly set the directory to 0755 when we create it, which probably should be 0700.
Note, you probably want to chmod 700 ~/.config. If your ~/.config is locked down, other users won’t be able to access its contents, regardless of their permissions.
The above PR is merged. I’ll try to cut a release in the next 48 hours.